Non-profit organization data breaches expose donor financial information, employee and volunteer personal records, and sometimes sensitive data about the individuals a non-profit serves, such as clients of a healthcare, housing, or social services organization. These exposures can lead to identity theft, direct financial fraud, and scams that specifically target donors using stolen names, giving histories, and contact information to impersonate the organization or solicit further payments. Non-profits are frequently under-resourced when it comes to cybersecurity relative to the amount and sensitivity of the data they collect, which can make them attractive targets despite operating on limited budgets. Depending on the organization’s mission, a breach may also expose especially sensitive information about vulnerable populations the non-profit serves, raising additional privacy concerns beyond typical financial data. This page tracks confirmed data breaches at non-profit organizations, including what data was exposed, which companies notified regulators, and what affected individuals can do next to protect themselves.
YMCA of Southern Maine notified regulators that a data breach compromised members’ Social Security numbers, financial account codes, and credit and debit card information.
The Health Trust has notified individuals that an unknown actor accessed its network and copied personal information in 2025, with formal notification going out in August 2026.
The Health Trust Data Breach Exposes Personal and Financial Information Read More »
Southwestern Vermont Council on Aging notified the Vermont Attorney General of a data breach that exposed health records belonging to individuals it serves.
Southwestern Vermont Council on Aging Data Breach Exposes Health Records Read More »
A former volunteer at Temple Adat Shalom Sisterhood in Poway, California kept and misused member contact lists for unauthorized advertising, even after being told to stop, prompting a formal breach notification to those affected.
Temple Adat Shalom Sisterhood Data Breach Exposes Names, Emails, and Phone Numbers Read More »
LC Industries, a nonprofit employer for people who are blind and operator of military base supply centers, disclosed to Vermont regulators that a client’s Social Security number was exposed in a security incident.
LC Industries Data Breach Exposes Social Security Numbers Read More »
Legal Aid Service of Broward County notified the Vermont Attorney General of a data breach that exposed clients’ Social Security numbers, raising identity theft concerns.
Legal Aid Service of Broward County Data Breach Exposes Social Security Numbers Read More »
Rochester Philharmonic Orchestra notified the Vermont Attorney General that a data breach compromised Social Security numbers belonging to an undisclosed number of individuals.
Rochester Philharmonic Orchestra Data Breach Exposes Social Security Numbers Read More »
Bloomington Roots Foundation, Inc. notified the Vermont Attorney General that a data breach compromised Social Security numbers belonging to an undisclosed number of individuals.
Bloomington Roots Foundation Data Breach Exposes Social Security Numbers Read More »
Ithaca’s Sciencenter museum notified individuals that their names and an additional category of personal information were exposed in a data privacy incident, prompting an offer of free credit monitoring.
Sciencenter Data Breach Exposes Names and Personal Information Read More »
New Apostolic Church USA notified the Vermont Attorney General of a data breach involving members’ Social Security numbers, raising identity theft risks for those affected.
New Apostolic Church USA Data Breach Exposes Social Security Numbers Read More »